What's Changed
- Implement challenge-response password proof (PBKDF2-SHA256) and credential envelopes to avoid sending plaintext passwords.
- Add rate limiting and CAPTCHA support for authentication endpoints (
login,register,change-password). - Introduce session expiration and
tokenVersionfor global logout and session invalidation. - Implement a strict Content Security Policy (CSP) and additional security headers (HSTS, COOP, CORP).
- Add support for webhook secret verification via headers or query parameters.
- Optimize Docker security by dropping
NET_RAWcapabilities and enforcingno-new-privileges. - Add a script to handle legacy session/auth data migration.
Full Changelog: https://github.com/ohmzi/Immaculaterr/compare/v1.5.6..v1.6.0
Updating
Docker
HTTP-only update (required)
docker pull ghcr.io/ohmzi/immaculaterr:latest
docker rm -f Immaculaterr 2>/dev/null || true
docker run -d \
--name Immaculaterr \
--network host \
-e HOST=0.0.0.0 \
-e PORT=5454 \
-e APP_DATA_DIR=/data \
-e DATABASE_URL=file:/data/tcp.sqlite \
-v immaculaterr-data:/data \
--restart unless-stopped \
ohmzii/immaculaterr:latestOptional HTTPS sidecar (can run anytime later)
mkdir -p ~/immaculaterr
curl -fsSL -o ~/immaculaterr/caddy-entrypoint.sh \
"https://raw.githubusercontent.com/ohmzi/Immaculaterr/v1.6.0/docker/immaculaterr/caddy-entrypoint.sh"
chmod +x ~/immaculaterr/caddy-entrypoint.sh
docker pull caddy:2.8.4-alpine
docker rm -f ImmaculaterrHttps 2>/dev/null || true
docker run -d \
--name ImmaculaterrHttps \
--network host \
-e IMM_ENABLE_HTTP=false \
-e IMM_ENABLE_HTTPS=true \
-e IMM_HTTPS_PORT=5464 \
-e IMM_INCLUDE_LOCALHOST=true \
-e IMM_ENABLE_LAN_IP=true \
-e APP_INTERNAL_PORT=5454 \
-v ~/immaculaterr/caddy-entrypoint.sh:/etc/caddy/caddy-entrypoint.sh:ro \
-v immaculaterr-caddy-data:/data \
-v immaculaterr-caddy-config:/config \
--restart unless-stopped \
caddy:2.8.4-alpine \
/bin/sh /etc/caddy/caddy-entrypoint.shPortainer
- In Portainer: Containers → select Immaculaterr
- Click Recreate
- Enable Re-pull image
- Click Recreate